bitwarden_policies/policy_type.rs
1//! The [`PolicyType`] enum.
2
3use serde::{Deserialize, Serialize};
4use serde_repr::{Deserialize_repr, Serialize_repr};
5#[cfg(feature = "wasm")]
6use tsify::Tsify;
7#[cfg(feature = "wasm")]
8use wasm_bindgen::prelude::wasm_bindgen;
9
10use crate::{policies::*, policy::ErasedPolicy};
11
12/// The type of an organization policy.
13///
14/// The integer value matches the server's wire format.
15#[derive(PartialEq, Eq, Hash, Serialize_repr, Deserialize_repr, Debug, Copy, Clone)]
16#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
17#[cfg_attr(feature = "wasm", wasm_bindgen)]
18#[repr(u8)]
19pub enum PolicyType {
20 /// Requires members to have two-step login enabled on their account.
21 TwoFactorAuthentication = 0,
22 /// Sets minimum requirements for members' master passwords.
23 MasterPassword = 1,
24 /// Sets minimum requirements for the password generator.
25 PasswordGenerator = 2,
26 /// Restricts members to being part of a single organization.
27 SingleOrg = 3,
28 /// Requires members to authenticate with single sign-on.
29 RequireSso = 4,
30 /// Forces newly added or cloned items to be owned by the organization rather than the
31 /// member's personal vault. Also enables My Items functionality.
32 OrganizationDataOwnership = 5,
33 /// Disables the ability to create and edit Bitwarden Sends.
34 ///
35 /// Superseded by [`SendControls`](Self::SendControls) when the
36 /// `pm-31885-send-controls` feature flag is active.
37 DisableSend = 6,
38 /// Sets restrictions or defaults for Bitwarden Sends.
39 ///
40 /// Superseded by [`SendControls`](Self::SendControls) when the
41 /// `pm-31885-send-controls` feature flag is active.
42 SendOptions = 7,
43 /// Allows administrators to recover member accounts.
44 ResetPassword = 8,
45 /// Sets the maximum allowed vault timeout for members.
46 MaximumVaultTimeout = 9,
47 /// Disables members' ability to export their personal vault.
48 DisablePersonalVaultExport = 10,
49 /// Activates autofill on page load in the browser extension.
50 ActivateAutofill = 11,
51 /// Automatically logs members into apps using single sign-on.
52 AutomaticAppLogIn = 12,
53 /// Removes members' access to the free Bitwarden Families sponsorship benefit.
54 FreeFamiliesSponsorship = 13,
55 /// Prevents members from unlocking the app with a PIN.
56 RemoveUnlockWithPin = 14,
57 /// Restricts the item types that members can create.
58 RestrictedItemTypes = 15,
59 /// Sets the default URI match detection strategy for autofill.
60 UriMatchDefaults = 16,
61 /// Sets the default behavior for the autotype feature.
62 AutotypeDefaultSetting = 17,
63 /// Automatically confirms invited users into the organization.
64 AutomaticUserConfirmation = 18,
65 /// Blocks account creation for users with email addresses on claimed domains.
66 BlockClaimedDomainAccountCreation = 19,
67 /// Displays an organization-configured banner message to members in their vault.
68 OrganizationUserNotification = 20,
69 /// Configures Send-related behavior: disabling Sends, email visibility, access controls,
70 /// Send types, and deletion.
71 ///
72 /// Supersedes [`DisableSend`](Self::DisableSend) and [`SendOptions`](Self::SendOptions) when
73 /// the `pm-31885-send-controls` feature flag is active on the server.
74 SendControls = 21,
75 /// Enables the Fill Assist targeting-rules autofill engine as the default for members who
76 /// have not explicitly set their Fill Assist preference, and optionally overrides the default
77 /// rules feed URL.
78 FillAssist = 22,
79}
80
81impl PolicyType {
82 /// Dispatches this runtime policy type to its concrete (zero-sized)
83 /// [`crate::Policy`] implementation, erased behind [`ErasedPolicy`] so the
84 /// differing associated `Data` types can be handled uniformly.
85 pub(crate) fn resolve_policy(self) -> Box<dyn ErasedPolicy> {
86 match self {
87 PolicyType::TwoFactorAuthentication => Box::new(TwoFactorAuthenticationPolicy),
88 PolicyType::MasterPassword => Box::new(MasterPasswordPolicy),
89 PolicyType::PasswordGenerator => Box::new(PasswordGeneratorPolicy),
90 PolicyType::SingleOrg => Box::new(SingleOrgPolicy),
91 PolicyType::RequireSso => Box::new(RequireSsoPolicy),
92 PolicyType::OrganizationDataOwnership => Box::new(OrganizationDataOwnershipPolicy),
93 PolicyType::DisableSend => Box::new(DisableSendPolicy),
94 PolicyType::SendOptions => Box::new(SendOptionsPolicy),
95 PolicyType::ResetPassword => Box::new(ResetPasswordPolicy),
96 PolicyType::MaximumVaultTimeout => Box::new(MaximumVaultTimeoutPolicy),
97 PolicyType::DisablePersonalVaultExport => Box::new(DisablePersonalVaultExportPolicy),
98 PolicyType::ActivateAutofill => Box::new(ActivateAutofillPolicy),
99 PolicyType::AutomaticAppLogIn => Box::new(AutomaticAppLogInPolicy),
100 PolicyType::FreeFamiliesSponsorship => Box::new(FreeFamiliesSponsorshipPolicy),
101 PolicyType::RemoveUnlockWithPin => Box::new(RemoveUnlockWithPinPolicy),
102 PolicyType::RestrictedItemTypes => Box::new(RestrictedItemTypesPolicy),
103 PolicyType::UriMatchDefaults => Box::new(UriMatchDefaultsPolicy),
104 PolicyType::AutotypeDefaultSetting => Box::new(AutotypeDefaultSettingPolicy),
105 PolicyType::AutomaticUserConfirmation => Box::new(AutomaticUserConfirmationPolicy),
106 PolicyType::BlockClaimedDomainAccountCreation => {
107 Box::new(BlockClaimedDomainAccountCreationPolicy)
108 }
109 PolicyType::OrganizationUserNotification => {
110 Box::new(OrganizationUserNotificationPolicy)
111 }
112 PolicyType::SendControls => Box::new(SendControlsPolicy),
113 PolicyType::FillAssist => Box::new(FillAssistPolicy),
114 }
115 }
116}
117
118/// Type-erased policy type + data for crossing the FFI boundary.
119///
120/// Each variant carries the strongly-typed data for one policy, mirroring the
121/// generic `Policy::Data` used on the native side. Variants are
122/// named identically to (and documented by) the matching [`PolicyType`] variant.
123///
124/// The discriminator is serialized under `_policyType` rather than `type` so it
125/// cannot collide with a policy data field named `type` (e.g.
126/// [`MaximumVaultTimeoutPolicyData`]), which the internally-tagged
127/// representation flattens alongside the discriminator.
128// Variants mirror the already-documented `PolicyType`, so per-variant docs would
129// be redundant boilerplate.
130#[allow(missing_docs)]
131#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
132#[serde(rename_all = "camelCase", tag = "_policyType")]
133#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
134#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
135// TODO: `SendControls` and `UriMatchDefaults` are temporarily unit variants. They gain
136// their data models in follow-up PRs, once `SendType`/`UriMatchType` move into
137// lower-level crates that this crate can depend on without a cycle.
138pub enum PolicyDataType {
139 TwoFactorAuthentication,
140 MasterPassword(MasterPasswordPolicyData),
141 PasswordGenerator(PasswordGeneratorPolicyData),
142 SingleOrg,
143 RequireSso,
144 OrganizationDataOwnership(OrganizationDataOwnershipPolicyData),
145 DisableSend,
146 SendOptions(SendOptionsPolicyData),
147 ResetPassword(ResetPasswordPolicyData),
148 MaximumVaultTimeout(MaximumVaultTimeoutPolicyData),
149 DisablePersonalVaultExport,
150 ActivateAutofill,
151 AutomaticAppLogIn(AutomaticAppLogInPolicyData),
152 FreeFamiliesSponsorship,
153 RemoveUnlockWithPin,
154 RestrictedItemTypes,
155 UriMatchDefaults,
156 AutotypeDefaultSetting,
157 AutomaticUserConfirmation,
158 BlockClaimedDomainAccountCreation,
159 OrganizationUserNotification(OrganizationUserNotificationPolicyData),
160 SendControls,
161 FillAssist(FillAssistPolicyData),
162}